Loading story…
A coordinated operation involving 131 Chrome extensions has been uncovered, with all extensions abusing WhatsApp Web to automate spam messaging at scale. These extensions, which are essentially rebrands of a single tool, share the same codebase, design patterns, and backend infrastructure, indicating a deliberate attempt to evade detection and maximize reach. The extensions inject code directly into the WhatsApp Web interface, running alongside legitimate scripts to automate bulk outreach and message scheduling. This activity is designed to bypass WhatsApp’s anti-spam mechanisms, enabling the operators to send unsolicited messages to large numbers of users. Marketing materials for these extensions falsely claim that their presence in the Chrome Web Store implies a rigorous security audit and full privacy compliance, misleading potential users and resellers. Contrary to these claims, the extensions violate both Chrome Web Store and WhatsApp policies by facilitating spam and unauthorized automation. At least 20,905 active users have been identified across the various extension listings, with some individual extensions, such as YouSeller, amassing over 10,000 users. The operation has been ongoing for at least nine months, with regular waves of new uploads and version updates observed throughout 2025, including as recently as mid-October. The extensions are marketed under different names, logos, and landing pages, but all provide the same WhatsApp Web automation interface, confirming their common origin. Security researchers have filed takedown requests with the Chrome security team and have called for the suspension of the associated publisher accounts. The Socket AI Scanner has flagged at least one extension, Organize-C, as malware due to its spamware behavior. The widespread availability of these extensions on the Chrome Web Store highlights significant gaps in extension vetting and enforcement. The operation’s scale and persistence suggest a lucrative reseller scheme, with the extensions being promoted as tools for mass outreach and marketing. The abuse of Chrome’s extension ecosystem for such purposes poses risks not only to WhatsApp users but also to the broader web platform. The incident underscores the need for improved monitoring and enforcement of extension policies by browser vendors. WhatsApp and Chrome users are advised to be vigilant about installing third-party extensions, especially those that promise automation or mass messaging capabilities. The exposure of this scheme may prompt further investigations into similar abuse patterns across other web platforms.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
Following the initial disclosure, several security news outlets reported on the same campaign, highlighting that more than 100 Chrome extensions were hijacking or automating WhatsApp Web for mass messaging and spam. These reports did not introduce a separate incident but amplified the scale and abuse pattern already identified.
Security researchers uncovered a large cluster of 131 Chrome extensions designed to automate or facilitate spam activity through WhatsApp Web, including bypassing platform anti-spam controls. The extensions were described as part of a broad reseller-driven spamware scheme distributed through the Chrome Web Store.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Astaroth** banking trojan has added a spambot component that hijacks victims’ active **WhatsApp Web** sessions to distribute malicious ZIP attachments, with activity primarily targeting users in Brazil. According to CrowdStrike, the malware launches a headless **Chromium** or **Microsoft Edge** browser through WebDriver, suppresses automation indicators, checks whether the victim is already logged in to WhatsApp Web, and then uses the legitimate **WPPConnect/WA-JS** library to enumerate contacts and send messages that appear to come from the victim’s own account. The spambot is designed to maximize delivery while reducing suspicion, filtering out groups, broadcasts, linked devices, unsaved contacts, the victim’s own account, and non-Brazilian phone numbers, while tailoring Portuguese greetings by time of day before sending lures. CrowdStrike also found substantial code and configuration overlap with the earlier **Vareg** spambot—including nearly identical contact filtering, message delivery logic, and delay behavior—indicating likely code sharing or a common developer; researchers published detection guidance, a **YARA** rule, and related filesystem, telemetry, hash, and domain indicators tied to the campaign.
Jul 31, 2026
Researchers uncovered a coordinated operation on the Chrome Web Store involving **152 “live wallpaper” new-tab extensions** spread across **38 publisher accounts** and three backend brands, with roughly **105,000 reported installs**. Built from a shared codebase, the extensions redirected install and uninstall traffic to operator-controlled infrastructure and monetized users through ad-driven destination pages including `tabplugins.com`, `yowgames.com`, `chromewallpaper.com`, and `owhit.com`. Investigators said the campaign functioned as an **adware-adjacent traffic-attribution fraud scheme**, not a remote-code-execution or classic search-hijacking operation. A **54-extension subset** used a newer template that forged **Google organic-search attribution** and disguised uninstall activity as legitimate search-result clicks, inflating the apparent value of referral traffic and polluting analytics. The extensions also contained an undisclosed service-worker routine that repeatedly attempted to delete `IndexedDB` data, a behavior researchers described as anti-forensic even though it did not appear to affect website data outside the extension origin and was ineffective against the campaign’s current local-storage state. The report also cited false Chrome Web Store privacy disclosures and minor data leakage through favicon requests for saved shortcut domains, highlighting ongoing abuse of the browser-extension ecosystem for stealthy ad-fraud operations.
Jul 12, 2026
Researchers uncovered a coordinated campaign involving **108 malicious Chrome extensions** on the Chrome Web Store that collectively reached about **20,000 installs** and were published under **five separate publisher identities**. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including `cloudapi[.]stream` and backend systems hosted at `144.126.135[.]238`. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across **54 OAuth-enabled extensions**, and Russian-language comments, indicating a single operator or centrally managed service. The extensions were found stealing **Google account identity data**, **browsing information**, and **Telegram Web sessions**, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, **Telegram Multi-account**, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a **malware-as-a-service** model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.
Jun 29, 2026